CVE-2025-8128

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-8128
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8128.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-8128
Published
2025-07-25T03:32:05Z
Modified
2026-10-28T02:30:44Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
zhousg letao product.js unrestricted upload
Details

A vulnerability, which was classified as critical, has been found in zhousg letao up to 7d8df0386a65228476290949e0413de48f7fbe98. This issue affects some unknown processing of the file routes\bf\product.js. The manipulation of the argument pictrdtz leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available.

Database specific 
{
    "cna_assigner":  "VulDB",
    "cwe_ids":  [
        "CWE-284",
        "CWE-434"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8128.json"
}
References

Affected packages

Git / github.com/zhousg/letao

Affected ranges

Type
GIT
Repo
https://github.com/zhousg/letao
Events
Introduced
7d8df0386a65228476290949e0413de48f7fbe98
Last Affected
7d8df0386a65228476290949e0413de48f7fbe98
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "7d8df0386a65228476290949e0413de48f7fbe98"
                },
                {
                    "last_affected":  "7d8df0386a65228476290949e0413de48f7fbe98"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandaloneSingleVersion"
        }
    ]
}

Affected versions

Other
7d8df0386a65228476290949e0413de48f7fbe98

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8128.json"